TheRealBrianF

"Now, in principle I don't mind paying for usage. But they promised self-serve signups before the limits are applied, which didn't happen - still no self-serve plans available. And the "contact us" pricing is too a large extent based on _popularity_ of the package. And not in a quantifiable way like "x GB downloaded", but rather "within the top 2% of usage" (by whatever hidden metric)."

-> This too is also factually incorrect. Self service rolled out on 10/1 along side the new updated limits that had a -30 day- grace period reset for everyone. So minimally you had 30 days before anything would be impacted...we are still at day 19 so no one has been impacted at all yet. The actual grace periods don't start until you go over the monthly limits so practically speaking it would take a few months before most things would have any impact.

"Then they started requiring paid plans for _all_ publishers that are not purely community projects. Doesn't matter how open it is, if it's backed by a commercial company, they require a paid plan."

This is factually incorrect and has been documented and discussed many times. The issue at hand is if something is open source vs "open source" but is really a free to paid go to market motion. This includes "open source" sdks that are only really used to build products against a paid commercial service.

We spend great time and care assessing each situation and discussing the results with the companies engaged with us to reach a fair conclusion.

If you think we got something wrong here, all you have to do is reach out and we are happy to walk you through what we see and drive to resolution.

--Brian (cofounder/CTO Sonatype)

I think you're obliquely referring to me there.

I covered some of this in one of my previous blogs where i talked about the systemic challenges here that I've uncovered. The heavy users that I spoke to, 100% of them had a repository manager, some Nexus, others Artifactory. And yet the high levels of consumption still persisted. I discussed some of the reasons for this in the blog link below... but I think this refutes the theory that simply having yet another caching proxy solves the problem. It really doesn't. Additionally as Mike discussed, bandwidth is only part of the challenge. Without the people behind the repositories doing the malware response, the curation of namespaces etc, there wouldn't be anything to proxy anyway.

https://www.sonatype.com/blog/free-isnt-free-the-hidden-cost...

You're referring to what I described previously here... ironically back when the first dependency confusion research was published: https://www.sonatype.com/blog/why-namespacing-matters-in-pub...

Sonatype Lifecycle is designed to analyze a built package and figure out what's inside it, specifically when there aren't manifest files to tell you what's -supposed- to be there. It can obviously do a lot more, but the analysis is designed to solve the exact problem you're describing.

https://blog.sonatype.com/mapping-the-javascript-genome-for-...